Analysis
-
max time kernel
167s -
max time network
187s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
24-05-2024 02:04
Static task
static1
Behavioral task
behavioral1
Sample
6d04af25e1e9b7336d2e57afbd62b999_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
6d04af25e1e9b7336d2e57afbd62b999_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral3
Sample
LibMemoryLeakMonitor.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
LibMemoryLeakMonitor.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
LibMemoryLeakMonitor.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
6d04af25e1e9b7336d2e57afbd62b999_JaffaCakes118.apk
-
Size
15.2MB
-
MD5
6d04af25e1e9b7336d2e57afbd62b999
-
SHA1
37750e7a23b0fe3c3e876c1898c456d6b525da3f
-
SHA256
1e8067ef7f6fce35184e7898724222374567f0f468edcff1d25e7636e0fb2528
-
SHA512
1091b69b459446691b74979eeebf3118685296097b214989a05d6edca7c390019a241c63cd9563aeb69f9f2f20986acbb8f4385f7a02ca9d12938ab84a510042
-
SSDEEP
393216:AS4kiviQJ95v4e751utE02uck8x3q1Nm/g4E6C:9/Qb75eETuc3x61A/gx
Malware Config
Signatures
-
Requests cell location 2 TTPs 3 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.dajie.business:remotecom.dajie.businessdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.dajie.business:remote Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.dajie.business Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.dajie.business:remote -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.dajie.businesscom.dajie.business:remotedescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.dajie.business Framework service call android.app.IActivityManager.getRunningAppProcesses com.dajie.business:remote -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.dajie.business:remotecom.dajie.businessdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dajie.business:remote Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dajie.business -
Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.dajie.businesscom.dajie.business:remotedescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.dajie.business Framework service call android.net.wifi.IWifiManager.getScanResults com.dajie.business:remote -
Checks if the internet connection is available 1 TTPs 2 IoCs
Processes:
com.dajie.businesscom.dajie.business:remotedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dajie.business Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dajie.business:remote -
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 3 IoCs
Processes:
flow ioc 36 alog.umeng.com 90 alog.umeng.com 103 alog.umeng.com -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.dajie.business:remotedescription ioc process Framework API call android.hardware.SensorManager.registerListener com.dajie.business:remote -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes:
com.dajie.businesscom.dajie.business:remotedescription ioc process Framework API call javax.crypto.Cipher.doFinal com.dajie.business Framework API call javax.crypto.Cipher.doFinal com.dajie.business:remote
Processes
-
com.dajie.business1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.dajie.business:remote1⤵
- Requests cell location
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.dajie.business/databases/campus_offcial_appFilesize
28KB
MD51f6aab9f6488555ac4f6393054c9c90e
SHA1d587b4aa047f0e8d0840f1f9bc5a428dee79f552
SHA2562342d5262efcec7740840de4dd008734b23088add01635aed2579f5770761379
SHA512c587f15c97783e41c950151caef082b94945b2cc517ccf57e7596a7713dbb9fab70bc6571625da521621437c08f3842ad660425c693d2191578d92e4545b7c51
-
/data/user/0/com.dajie.business/databases/campus_offcial_app-journalFilesize
512B
MD5da2b156d1aed297c1a7bc632dcf5942a
SHA106246de6412c0ac2f3ad84b930f61148093c54cb
SHA2569fbf7b0d23a6b253fcabe5e57ce43458c38e5eb158f12c85af7afe6ab976bb1b
SHA5120cd878b74765b3c838b022af39000ac45c4cee2f5efdd751742260c771fb0230e888b978c65d9e361c487eeb13affc3375cb7020c8a143d29faf5e428238900b
-
/data/user/0/com.dajie.business/databases/campus_offcial_app-journalFilesize
28KB
MD5e2c58b77c8409b969743565ec4a39d38
SHA1cf67fd7fe48b4c0d371c7038953d96ae66cee0a4
SHA25656574ed9d8db3a39aa60baaafa9f8b1c55353a494718918eceebb096ef1f773c
SHA512768db6a41301f9b0d6e36911e2635bd5d4f69e7b5ca755787b7d53669e2ce740669b8a5d2d0c5e49c765195af9098f6c61a87c12be7cfe435d4f19e26597813b
-
/data/user/0/com.dajie.business/databases/campus_offcial_app-journalFilesize
8KB
MD5fc23cea815bdda5dd17e8ea2c76a2138
SHA1635b632834630f2cb16df12e60925eb3e2e8e900
SHA2565eea56a740fa46399f26bb567805b5f39f5f4fa86f7d6777ebcee0822fcbaeb2
SHA51235e56a57d8c7cc51d8012043685da7154dfc8c2cf7360229f210e0fd2421494642777dc0d45d92c5489d7751477654fefe6283c09b9d8f6a4d29b939d81b089a
-
/data/user/0/com.dajie.business/databases/dajie_businessFilesize
112KB
MD5a135f0ddc651414dcbd41984649f0084
SHA19db67cc06f7104ff20182cb51e969f33977b130f
SHA256454b805b540f8672876e991f0be6170f464fa1e14afa248e70fa5b28b2e5bd87
SHA512c7c68f932e6ac622240f7d349923048d54bed3d1ba753e891a046db209d9db065d010ffef5bccf07d27328373e0a46543b097acc01d638490d33febb6e9fd7da
-
/data/user/0/com.dajie.business/databases/dajie_business-journalFilesize
8KB
MD5611f883e406b238b9277b30f118aba74
SHA15a314425d531ac96059aa8df66dcb1250aa1206c
SHA25659fabb595f1d9846217f01d5b13e2f9260c582b4faec08386ecbad64d19dc709
SHA5129285538b6a1ed51dc0a65662e7851d61292034de0844fc4dca6d576af37c613020aee73105aafd517c57a70fafd24ca40ec54475d9ec32a9d4d386801ff5b5fb
-
/data/user/0/com.dajie.business/databases/dajie_business-journalFilesize
8KB
MD53d4827cee156f859ab621681efeb9811
SHA16a1d104e19b284288f98f5f8c4cfb3f28551130e
SHA256f67fbc368169994a8802b51a779d5932c71430aa662642c18e291e9ec576c524
SHA512e7db5bd489d6856bd2e94d713d1507049755b7f3f074aed3130ea4a5fe128463723c97e0eb7598c47ae7597d0308c37432991e66d259ff0802486e68656adf52
-
/data/user/0/com.dajie.business/databases/dajie_business-journalFilesize
8KB
MD5440a8a638e0eb7a0941299b37d1de1dd
SHA137d26ccc0da602bc566f7359cf85bafc3e0251ad
SHA256dcc2e75bd1059e1040af5c280dc497bb5cc698be2b0f34da0bb8feff5e25ae89
SHA512ab6251d5a9468a03eff1921aa490af2833db5979b2946d0f79b1a47b1d4d441db4554b7faaf0a0166e65061772e8d2ee156d9ddd4c3a2e54cdcd4bcf1fc8bb9c
-
/data/user/0/com.dajie.business/files/libcuid.soFilesize
109B
MD5aab8aee7ed22f4718990774107dfb573
SHA171c23ea1ecd5c2af012d7d5ce1854384567c2a21
SHA25637ddd4f73908623f6b606b328f93ad08c0396a18e60032c46bbb82c6c6d84f47
SHA512c57b5bcd4b1a887ea67365856301bd0f079db0fce354acb0b5f3edbd469005e311dc678e11640fb2cf6805a6600b9c28e768fd6cef11206f3eb91717513fbc2c
-
/data/user/0/com.dajie.business/files/lldt/firll.datFilesize
76B
MD5e68900302c8604be0981a2b365294a7c
SHA1c874b918b80e0b01dc4433dbb66a1c7dc78ce5b7
SHA2564feafda887b90cab4ddce9c60f1bb415acb7153bbd15984a52d97b3f2011cd5b
SHA5122b37430b9be77c2ad39aa9ce6e6b2722f0d5d9a52dbb9cadd2c3a4aaf7ef80ebe23b574f15116a14fcf0cd432a86cbfbf136d063c033468c0c46d72f865152b7
-
/data/user/0/com.dajie.business/files/mobclick_agent_cached_com.dajie.businessFilesize
120B
MD5ab1f613eec71e7950909f5f1c66b1a36
SHA1fc8c3735a37b5f06caf7bc47a627a0045bb1fa58
SHA256f04a0aee53c897918fd2f006815854a1ba1106b9145d55059e8a24418750a846
SHA512aa13a2bfbde1236051b0eed74a626bd2e4e7c64d530c5939f7cc0d479556fdb7657ccd135058654bf09b940ee705ccf79113cd68c06d8e5fe617247636c3bf26
-
/data/user/0/com.dajie.business/files/mobclick_agent_cached_com.dajie.businessFilesize
208B
MD5b8491a1423bfec72b4c261c8aa3be730
SHA177d9e6e6d5e29403eafefa79bb2cf328c2b5252b
SHA25675c22bea53ab4af88fb98fba9889f95e84ea86e81d896fbdb91fc12f3fe89fdd
SHA512da2bc691177b3c0d651ac24bfc7649fad474d76d538a1bb5297c6c32151e591501b7f336dad62a67fdf1075ed4a8fb407a925107ece5b4390f78bed818d12df8
-
/data/user/0/com.dajie.business/files/ofld/ofl.configFilesize
235B
MD591f429ca44fd3eb422ca88e9bcd5fa3a
SHA1212a27fedfde7263d9bf1f300eaae062b0f3bcb1
SHA25698486198d6bad8e9e710584eced87ef80634549341a0258ae8d057dbe1d6e24a
SHA5124518840769617c47a0000e1ea1f5a8b610718ef957fbb8af71b6af4962cc0eda21abbcffe96769a09387061ddf7a94622cca11cc0a5a64b55a6114dc6a60ac64
-
/data/user/0/com.dajie.business/files/ofld/ofl_location.dbFilesize
28KB
MD570250d085aabacd99c041ce264938e43
SHA1dad342fb53882dcc32e1ce04be265a342daf4907
SHA25689fd8bcda94093e5008bb7c7dbdcc4fe0345daef72c1ff4b7d28d36cb085bc57
SHA512d2220e709d1a5a5ae3412321d2d300acf14d2a63be0ff8d64b39fc19172498938685ab830aaea1373ece3b6ce5178d19e3ba81349ecf642f3e58a54703f6f496
-
/data/user/0/com.dajie.business/files/ofld/ofl_location.db-journalFilesize
512B
MD56cfde4a69c927e9707133735f0979f81
SHA1ea6cf913b874b4041d5a8b4b040622972e52c4ac
SHA25694e7e7e18df2ebeb8a4e40db6ae0244cbe1a1ab3cf0792668a5ec69154a351fa
SHA512f80e1ccebd2d7e3ab7d939cde3a7288238179076f2a7a6c2a8e391f48210acdd6378d8865d49d327ec46e3b9d6d6d56f1b166a3133c32cd27ec28e0a0f926e7c
-
/data/user/0/com.dajie.business/files/ofld/ofl_location.db-journalFilesize
8KB
MD5d2fa902a20e95a68710d651afc3fc48f
SHA1ae6626cc8daddc47db929a2dd210702798d0a8bb
SHA256aeee24d72bc9ede916440078dabd505c0fe08e3d5ee57eae724f3b84bb4e415e
SHA51208420d99f45a4f6c924eeed94e9805c0b9fda739ff6fe7a805df0e60ca99f046a96f460fd25bd379d84c79376269ea0395849835aa5d78ba5b6a1bade83b4382
-
/data/user/0/com.dajie.business/files/ofld/ofl_location.db-journalFilesize
8KB
MD5a30adac0fc17974e6598b4132d166077
SHA1508944d638ddd55fe1c300583fbe550f085be0d5
SHA256324e06e55060b76ae4323eab6834b75051506b262945b9022b40a4cde69fa071
SHA512b77fa8f5a94e15f5922d54ba866b2596ab7960cffc67e68fa4d75451d0af8dedc087122bddaf9392bab0516cb43adb52b3cbcd9b9750fd4317358b19f076d017
-
/data/user/0/com.dajie.business/files/ofld/ofl_location.db-journalFilesize
8KB
MD51a6a05fc79a1b93109acd76f1d83a0ef
SHA178f4542a77b73e3abf81def0f63fd457e52dfe04
SHA25691acbb1b35ac8c92555fc4e83f11680bace345ec369fbb18e13cc505c8ccddf6
SHA5123385c17c7a588df7db958157877d16950fa2d9402170b09abfe5834517e4144b826bff07d6bb06f69019bf074ff226e557f4adc7360e8bc7e6c7b454ace46644
-
/data/user/0/com.dajie.business/files/ofld/ofl_statistics.dbFilesize
80KB
MD5faeea37abd335887cba10e6065b19973
SHA16f766fd898f257b5bd965900726606372fdc5d98
SHA256d7d98faf14c873d571ff254741bc81968ffe3329fba66a6e26d8386153720fb3
SHA512912c54574acb103dd2d25388213b04c212f8001282d52580f68243e222c1e79d7237a96bc717bb6f1cfcb9a455ef1464799e11b79e1b17de5a248a1015b54e3e
-
/data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journalFilesize
512B
MD5f20b258ae514bc25e9796e75df10e889
SHA1ceadcb7f6c30bb53170a97c9301bfafcad762106
SHA2562ce6a18178533d4e5de6f708e916fce0b704a6e22944fe8cd3f740ada324f77a
SHA512d5b35555fa824e206d948d420c075c0f6ae1afd5e1dacb27c433d0e6bd771743c81dfba144362c41ffc697242192764e54104ce355a583d1f69310eb7db5acbd
-
/data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journalFilesize
8KB
MD51ff403f4bad49d7086baf3d41c7ecd65
SHA13fc6ba1fd78b403cc9ae972e88407b9c76c40ef1
SHA2560c2eb42e4d9ebb2d09d9a44cb9e83a44c4210c3e0d206a13e68f3fef49bd402a
SHA512c73f465ce2a544524d4292c7efe211684895737f367aa8a2e684ce47581e9a271ea790598eb266a58fef66324c4a0d81c7c174a715c89c08a79dd9c90e882ffe
-
/data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journalFilesize
8KB
MD5b80fd48c2a8e1b09fb4873d2421c2540
SHA1f1fabb3fdd2e01658551dea490c684e62346e34b
SHA2560fefc21bb016489abe944b4cd0db32a139be14f6b7f2299891851b44f301be15
SHA512bfe2eb4f8095afbf7a1aa8cdaaed5fafbd796cb2cf6bdc9d37aa0ff82a55732ef59731e04203858101da510d432f57096f1415f92a64844274832ef7cd81c400
-
/data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journalFilesize
8KB
MD5d93724bafdff425b64bc5307565fc6ff
SHA17cb91f18cb50706a0ad4a9c4ebfff67805f017fb
SHA25627cd832c6da9028b93f6c5a891d95878a567a47ff405ed9fd0f4b941655e11fe
SHA512b37108f42c43410fd72bfa43f9a88d77a6c8ddf8030907b5fd498f8441f48ab78c252632b72de1da816a4a3558266bcf1eaa6553f3121b2b54152fdaeafde79e
-
/data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journalFilesize
8KB
MD557ffcc62304228f93fa24330f903c960
SHA1f62ff708c19ed9fbd6a7d78add71e57b650ffaf0
SHA2565e87a7932a6531822246abd9da0d059d3e58ba45f99c7918ee8f6d5396f3c0fa
SHA5122edc2d0a1001cb3636abc4e1fafbfc1712469961966da1da6eb35ddb72e0be125807def8e3e4b3cf06be6ccc239bb7f5591ea4a74380132472121bea778a7691
-
/data/user/0/com.dajie.business/files/ofld/ofl_statistics.db-journalFilesize
8KB
MD5a956d0af9a737c47d6a1a1affeb0dd51
SHA14fad20a6a376cd9320916eb48d5d62531c934cce
SHA2567fa1e99c7f4aeb2c616c6cd864e59fd50e7194d72d1596cfadbb8fac466b91cb
SHA512e49afc0bfc0f9aeafd2bb948fe9d0b949da184d261481808f6291533e78d8d6c8692cdc2e5ccbefac98332869ffffc26ad547f59f1f52ce0b9efcaf4ee346bc4
-
/storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/conlts.datFilesize
12B
MD58d80bc8ea90e9cac010d3ddf97bda5f5
SHA1f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA256f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
SHA5129ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7
-
/storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/conlts.datFilesize
155B
MD54a6119f3858692f4891d0dd1789c4c26
SHA1c040e1fb8f2f6916f941181f83113c2bd27ae6d0
SHA256ba68ae29d5cf9f8ac50db246a4c7d62a5ee83963c4423a5949024862f544ca25
SHA5128e63a42adb8c10b58c8a540d7bd12dd26a958eb8e49b387f199499a12080a65d906b1cc0194dee44d530c156d98e6cd171b9f447304738a4e4babe2dfe00062c
-
/storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/llg.datFilesize
24B
MD5161557b06b4a4d3ce095528dea370eb7
SHA18bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f
SHA256f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4
SHA51296ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449
-
/storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/llg.datFilesize
478B
MD55c4fedf56c27ada005d05819bb05e6cf
SHA1d8fb7588add7770997d34ce24b672c435ae0d4df
SHA25649939247a355d35c25c7c0c923d380dc9d41a65672013f7a4b7c56401eeb7c47
SHA51229b9a689e5e1c8df2853115169c9d46578f98fe43106aeee970b75c7710a60d2e7db347335d4447581eb9b5f1d3ef2b56a15bf09e718165c56265bb8ae54ef5a
-
/storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/yoh.datFilesize
24B
MD5a936690571e9104e1922dda4a0ba5bd1
SHA165f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA256f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
SHA5123be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394
-
/storage/emulated/0/Android/data/com.dajie.business/files/baidu/tempdata/yoh.datFilesize
24B
MD51681ffc6e046c7af98c9e6c232a3fe0a
SHA1d3399b7262fb56cb9ed053d68db9291c410839c4
SHA2569d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA51211bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
-
/storage/emulated/0/baidu/tempdata/lcvif.datFilesize
96B
MD5ca5bc09b3632705466c52cc745b9ed9e
SHA1b044c2efe8f427d3c088a0530ac2777d43c49d03
SHA256e0c1c7c39be35cf17f8e2483a79af36e66ae7cb59cccbd0cc37315e86bfea2f9
SHA512021335c216cd1af5367ed95f3fcfb03b969237245aa2a6a3dfec77fb114cf04078e089545a60c1d326ac29dce5f0828cddd915f89e8f1e71b5b4828bf30ce88f
-
/storage/emulated/0/dajie/crashlog/crash-1716516356955.txtFilesize
3KB
MD54aba9f64280727fbea137fa564c320c8
SHA172e3d005bb34f94f0f1dc59a68af4bb48c92dd10
SHA256c78735f55e8c76a79f31485473d27d293ffc965d66841608b64b94cba4a946e8
SHA5122f8f514fd0a484d9dc80acc81ae62923386c9fa558d2e2d606d2a0097479f8e6eb5a01a5ea42a85817faf9e60d3f25a7baaddf8d7cd209794bccfb124441e893
-
/storage/emulated/0/dajie/crashlog/crash-1716516428234.txtFilesize
3KB
MD5a63985f2d866208d6c62074083c686f7
SHA16f7b8604385ad83bc37b2f09bf7fd23a08befa4a
SHA2563a5aa2441a31adc2a98f5bc311911c9385f658711871d0d903bb8fd8c4cce8d9
SHA512ab101524eea1da78df81be5692afbdd74e3b136c2eeeaf2916862bd72c15ad688ba08d17b58c50450621b334dcaf874ba45444cacf0fcf6cd1e8e7513aea97d5